5 September 2023
A message from the ATO: This tax time, we are receiving an increased number of reports about several ATO impersonation SMS and email scams.
These scams encourage people to click on a link that directs them to fake myGov sign in pages designed to steal their username and password.
Scammers use many different phrases to try and trick recipients into opening these links. These include (but are not limited to):
- 'You are due to receive an ATO Direct refund'
- 'You have an ATO notification'
- 'You need to update your details to allow your Tax return to be processed'
- 'We need to verify your incoming tax deposit'
- 'ATO Refund failed due to incorrect BSB/Account number'
- 'Due to receive a refund, click here to receive a rebate'
The images below are examples of the format this scam can take.
Do not open any links or provide the information requested.
We won't send you an SMS or email with a link to log on to online services. They should be accessed directly by typing ato.gov.au or my.gov.au into your browser.
We may use SMS or email to ask you to contact us, we will never ask you to return personal information through these channels.
Report any suspicious contact claiming to be from the ATO to ReportScams@ato.gov.au.
We're seeing an increase in fake social media accounts impersonating the ATO, our employees and senior executive staff across Facebook, Twitter, TikTok, Instagram and other platforms.
These fake accounts ask users that interact with the ATO to send them a direct message so they can help with their enquiry.
The people behind these fake accounts are trying to steal your personal information, including phone numbers, email addresses and bank account information.
The best way to verify that it's really the ATO is to:
- check how many people follow the account. Our verified Facebook and LinkedIn accounts have over 200,000 followers, and our Twitter account has over 65,000 followers
- check activity on the accounts. Our social media channels have been operating for around 10 years – if it's a newly created account, or only has a few posts, it's not us
- look for the grey tick next to our username (@ato_gov_au) on Twitter and the blue tick next to our name (Australian Taxation Office) on Facebook
- make sure any email addresses provided to you end with ‘.gov.au’.
The images below show examples of what impersonation accounts might look like.
If you're approached by an impersonation account, do not engage with them. Take a screenshot of the account, email the information to ReportEmailFraud@ato.gov.au and block the account through the social media platform's reporting function.
